This invention relates to an improved burner control system, and more particularly to means for supervising the operation of elements in a control circuit for the system.
In order to ensure that a burner will be operated only in a safe environment, burner systems are normally provided with means to sense the condition at various locations in the system, and to feed an array of condition sensing signals to a control circuit. The burner fuel valve is opened to admit fuel into the combustion chamber only when the pattern of condition sensing signals indicates that it is safe to do so.
A dangerous situation can result if the control system does not function properly, the hazard being particularly severe if the control system fails to react when the burner flame goes out. In this event fuel will accumulate in the combustion chamber, creating the possibility of an explosion should ignition again be attempted. Checking for proper operation of the control circuit is therefore of considerable importance, particularly for the portion of the control circuit that processes a flame indication signal. Also, a failure of the fuel valve to respond properly to signals from the control circuit can lead to the same problems as those associated with a failure of the control circuit itself. If either the control circuit or the fuel valve actuating circuit does fail, it is desirable that they do so in a manner that will not result in fuel accumulating in the combustion chamber.
In recent years burner control technology has made advances in the use of solid state switching elements or computers for the principal portion of the control logic, in contrast with the high capacity relays traditionally employed. Although the new devices can be smaller and less expensive, relays have the advantage of a generally predictable failure mode, i.e., it is predictable whether the contacts will be conductive or open when failure occurs. This is particularly true when large safety factors are built in. With solid state switching devices, however, it is usually impossible to predict the state the device will be in at failure, and a satisfactory self-checking system must be able to respond to the failure of a switching element in either state.